Lucene search

GoogleOSV:PYSEC-2014-97

HistoryJan 07, 2014 - 6:55 p.m.

PYSEC-2014-97

2014-01-0718:55:00

Google

osv.dev

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

JSON

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

CPENameOperatorVersion
apache-libcloudeq0.12.4
apache-libcloudeq0.13.0
apache-libcloudeq0.13.1
apache-libcloudeq0.13.2
apache-libcloudeq0.12.3

Name	Operator	Version
apache-libcloud	eq	0.12.4
apache-libcloud	eq	0.13.0
apache-libcloud	eq	0.13.1
apache-libcloud	eq	0.13.2
apache-libcloud	eq	0.12.3

References

libcloud.apache.org/security.html

lists.opensuse.org/opensuse-updates/2014-02/msg00015.html

www.securityfocus.com/archive/1/530624/100/0/threaded

www.securityfocus.com/bid/64617

digitalocean.com/blog_posts/transparency-regarding-data-security

github.com/fog/fog/issues/2525

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

JSON

Related for OSV:PYSEC-2014-97